Low risk browser extensions

Peacock TV Skipper sends Peacock account details and server-commanded account data to me3x.online and metricsmint.quest.

PitchBook Extension reports each active tab's domain to PitchBook profile lookup APIs.

Pixels Game Assistant loads a script URL from its own server's config and injects it into play.pixels.xyz with no integrity check.

Popup Blocker for Google Chrome injects a notification iframe that any page script can hide with a postMessage command.

Pure motion sends scoped video-page URLs and fetched provider HTML to www.thepuremotion.com.

QLattes loads Font Awesome from use.fontawesome.com when it annotates CNPq Lattes CV pages.

Qudelix performs a cleartext IP geolocation lookup to ip-api.com when its extension UI loads.

RazorWave Video Downloader sends detected video page domains to Google's favicon service when its popup opens.

ReYohoho Twitch Extension sends your Twitch ID and watched channel to its backend for its friends feature.

Recent Tabs displays recent tab titles, tab IDs, and favicon image URLs in the current page's DOM.

Resize Gmail Sidebar by cloudHQ sends Gmail account identifiers to cloudHQ during Gmail page initialization.

Return YouTube Comment Username displays channel handles on YouTube comments and exposes a postMessage bridge to all YouTube-origin scripts.

Savefrom for vk content (ak. VK Saver) sends a stat beacon to aferon.com from VK-family video pages.

Search Potato loads externally hosted S3 content whenever its new tab page opens.

SearchLock+ fetches rule sets from searchlock.com every 12 hours and installs them as network redirect and header rules on all sites.

SearchOnSite sets itself as the default search engine and sends usage IDs and browser details to its servers.

SimilarTube reads the public contact email off YouTube channel About pages and sends it, plus your account name, to its own servers.

Spelunky Classic sends a persistent extension-local client ID to Google Analytics when it runs and every hour afterward.

Spoken sends shopping page URLs and related product image or page data to Spoken and PostHog services.

SpyHunter Web Security forwards navigated URLs to its backend and transmits hardware IDs and browsing statistics to Google Analytics.

Squadrats Route Planning copies its persistent UID into localStorage on supported route-planning sites.

This extension unblocks copying, text selection, right-click, and context menus on websites.

Super Sound Booster sends a persistent per-installation UUID to Google Analytics every 60 minutes.

Tables for Gmail by cloudHQ sends Gmail account email addresses to cloudHQ during Gmail startup.

The Guestbook Extension loads RudderStack-controlled scripts on travel and hotel pages.

To-do List Chrome Extension sends a persistent visitor ID to onlineapp.pro during its new-tab paywall flow.

Tonalis Audio Recorder sends hourly Google Analytics events with a persistent extension-generated client ID.

TopCash lets any webpage ask the extension to open an attacker-chosen URL in a new tab.

TorBox Control sends hashes of supported download links on visited pages to TorBox cache-check APIs.

UTN.BA Helper uploads hashed student IDs, academic data, class schedules, and survey responses to its developer backend.

Udemy Course Downloader opens an affiliate tracking tab on install and when downloads start.

UltraWide Streaming uploads streaming account details and viewing history from eight services to me3x.online.

Unfolks reports Instagram workflow errors to Sentry with the current page URL, referrer, and user-agent context.

IG Unfollow AI exposes an analyzer page that reads Instagram follower lists and sends avatar URLs to proxy.lazytech.workers.dev.

VTopNaMP intercepts Wildberries search queries and product browsing data and transmits them via WebSocket to wss.wbservices.ru.

VetRec accepts external extension messages that can open caller-supplied URLs in new browser tabs.

WA Web Utils - Message Sender sends your WhatsApp account phone number to its subscription-status API.

WAContactSaver sends WhatsApp Web page telemetry to Google Analytics after injecting its bundled script.

Webnovel Translator by OpenNovel posts scraped novel metadata to novellist.co when the user runs a Novellist import.

Wordle Timeless sends a persistent extension client ID and hourly run events to Google Analytics.

Zluri Web Extension logs every page visited across all websites and uploads the browsing history to its own servers.

ZoneAlarm Web Secure authenticates to its local security agent using an API key hardcoded identically in every install.

adam:ONE assist sends failed HTTPS navigation hostnames over HTTP to mytools.management.

color picker for website - monster pick contacts colorpicker.monster on install/update and can open a server-provided tab.

iPacket SalesHub sends user email and vehicle appraisal details to PostHog during value appraisal actions.

m1pro sends Monopoly One page titles and URLs with a persistent client ID to Google Analytics.

right-click QRcode reader decodes a QR image locally, then opens the decoded text as a new-tab URL after a single OK prompt.

VPN for Gemini routes Google and Telegram traffic through configured proxy servers.

Auto Price Checker sends product page details to kakaku-navi.net for price comparison.

Wanteeed tracks visited merchant URLs, referrers, and co-installed extensions, and sends this data to its analytics servers.

Mate Translate sends daily translation statistics and account email to Gikken servers and transmits a persistent device ID at install time.

ImageAssistant sends a persistent per-install tracking ID and extension version to pullywood.com on every startup.

GMX MailCheck for Firefox ships hardcoded OAuth2 client secrets and may silently enable telemetry during version upgrades.

Synology Image Assistant Extension accepts postMessage commands from any webpage, enabling relay to the local Synology desktop client.

Foxy Gestures is a local mouse-gesture extension that operates entirely within the browser with no external data transmission.

Distill Web Monitor sends monitored page URLs and tab URLs to Sentry error reporting when exceptions occur.

Yandex — Homepage sends a persistent browser UUID and extension runtime ID to Yandex servers at startup and every two hours.

Location Guard ships a hardcoded third-party geocoding API key in its extension bundle.

easyScholar displays journal rankings on academic pages and routes translation requests through its own servers and third-party APIs.

Colorpick Eyedropper ships a hardcoded Google Safe Browsing API key in its bundle that any user can read.